Quick wins for a faster PC:
Clear out junk files and repair common Windows errorsFree Scan →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Treat every tool definition an MCP server provides—including its description, input schema, and output schema—as untrusted input. Capture what the server advertises, inspect it against the tool’s stated purpose, compare it with a reviewed baseline after changes, and hold changed definitions for approval before an agent can use them. A matching metadata hash can detect definition changes; it cannot establish that the server’s code or behavior is safe.
What an MCP manifest audit covers
Tool poisoning is a form of indirect prompt injection: malicious instructions placed in a tool description can influence an agent’s decisions. Microsoft for Developers describes this threat as instructions embedded in MCP tool descriptions. Microsoft for Developers’ explanation of tool poisoning discusses how altered descriptions can steer a model toward unintended calls.
![Claude AI for Beginners Bible: [5 in 1] The Ultimate Guide to Automate Your Work, Save Hours Every Week, and Use AI for Real-World Results](https://m.media-amazon.com/images/I/415+fSJacsL._SL160_.jpg)
As an Amazon Associate I earn from qualifying purchases.
Do not limit the audit to prose. Inspect the tool name, description, parameter names and types, required fields, and return schema, as well as annotations or other metadata supplied with the definition. OWASP identifies the whole schema—not just the description—as a potential injection surface. Also consider definitions in the context of other connected servers: a tool description can affect which tool an agent chooses.
Audit the manifest before exposing tools to an agent
-
Capture the advertised definitions
Connect with the intended MCP client and record every advertised tool’s name, description, input schema, output schema, and accompanying annotations or metadata. Preserve the exact text and structure so reviewers can examine what the agent would receive.
-
Flag suspicious instructions
Look for text that claims to override system or user instructions, requests credentials or hidden context, directs data to an unrelated destination, demands unrelated tool calls, or asserts authority beyond the tool’s stated function. Record the exact wording and the field where it appears. These are practical review triggers derived from the documented threat; they are not an official scoring rubric, and no checklist can establish that a description is harmless.
-
Check whether the schema fits the tool’s purpose
Compare parameter names, types, required fields, and output structure with the tool’s stated function. Broad or unrelated inputs, unexpected fields, or a changed return format deserve review. A benign-sounding description does not make an incongruent schema safe.
-
Compare with an approved baseline
After review, store the approved definitions and their cryptographic hashes alongside the server’s identity and version information. On reconnection or update, compare the newly advertised definitions with that baseline. Route differences to human review and do not expose changed metadata to agents until it is approved. Microsoft Learn similarly advises auditing descriptions for every configured server, not just one server’s tools: Azure MCP Server security guidance.
Special offer. See more information about Outbyte and uninstall instructions. Please review EULA and Privacy policy. -
Review implementation and behavior separately
A metadata hash only tells you whether the hashed definitions differ. An unchanged definition does not prove that server code, dependencies, permissions, or behavior behind it are unchanged. Assess package provenance, version changes, runtime permissions, and observed behavior as separate audit surfaces.
-
Restrict what a compromised tool could do
Give each server only the permissions it needs, and require user approval for sensitive actions where the host supports it. Enforce authorization on every request in the server; do not rely on the model to decide whether a user is allowed to perform an action. See OpenAI’s guidance for remote MCP servers.
-
Log changes and reassess
Keep records of definition changes and tool invocations so unexpected behavior can be investigated. Re-review definitions and server provenance periodically and when the server or its version changes. These measures reduce risk; they do not by themselves amount to a complete security audit.
What hashes, prompt shields, and authorization each do
| Control | What it helps with | What it does not establish |
|---|---|---|
| Reviewed baseline and metadata hash | Identifies changes to the definitions included in the comparison and provides a basis for update review. | That the server implementation or behavior is unchanged, or that an approved definition is safe. |
| Prompt-injection inspection | Can flag suspicious content entering agent context, including tool descriptions or outputs, depending on deployment architecture. | Reliable detection of every malicious instruction or authorization to perform an action. |
| Server-side authorization | Enforces access decisions for each request at the server. | Integrity of tool metadata or safety of server code and behavior. |
| Human approval for sensitive actions | Adds a review point before supported high-impact actions proceed. | A replacement for least privilege, server-side authorization, or implementation review. |
For deployments where it fits the architecture, Microsoft identifies Azure AI Content Safety Prompt Shields as an option for inspecting content entering agent context, including tool descriptions and outputs. Treat this as an additional inspection layer, not a substitute for change control or server-side access enforcement. Microsoft Learn’s Azure MCP Server security guidance discusses the option.
Keep MCP authorization checks in scope
Manifest review addresses malicious or changed tool metadata, but it does not replace protocol authorization safeguards. For MCP authorization, check audience-bound token validation and client PKCE protections as separate controls. These safeguards address authorization threats; they do not determine whether prose in a tool description contains prompt injection. Consult the MCP authorization specification for the protocol requirements.
Best Value
Decide what should block an update
There is no established universal pass/fail score for auditing MCP manifests. Set a review policy that fits the server’s risk and define which changes require blocking until approval. At minimum, hold updates when they introduce instruction-like text outside the tool’s purpose, unexplained schema changes, requests for sensitive data, or permissions that exceed the tool’s role. Record the decision and its rationale with the approved baseline.
For each control, be clear about its coverage and enforcement: does it inspect descriptions alone or schemas and outputs too; does it merely alert or block pending review; does it run during onboarding or at runtime; and what limits impact if a tool is compromised? A prompt shield may inspect context, while a hash can detect definition changes. Neither replaces implementation review, least privilege, or request-by-request authorization.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
Free tools Windows power users keep installed
One-click scans. No signup required.
